PHP vulnerabilities trigger website shutdowns

Multiple organizations, including Météo France, the French National Commission on Informatics and Liberty (CNIL), and the City of Paris, have temporarily disconnected their websites due to critical vulnerabilities in PHP. Orange, a major telecommunications company, also suspended access to several websites, services, and applications within its subsidiaries.

Exploitation attempts observed in Europe

In the Netherlands, the Tweede Kamer, the lower house of Parliament, temporarily shut down its website, and the national CERT is investigating "first signs of successful exploitation" of the vulnerabilities. The German ANSSI (BSI) states it is not aware of any "generalized and successful" exploitation but acknowledges the patches are effective.

Patches released for various PHP versions

The current patches include updated versions of PHP 8.2, 8.3, 8.4, and 8.5, as well as backports for older versions (7.4, 8.0, and 8.1). Canonical has patched Ubuntu versions, including the latest LTS releases, and rolled back additional versions for Ubuntu Pro subscribers. Debian has integrated the patches into its repositories, and Red Hat and SUSE have also addressed the vulnerabilities in their respective distributions.

PHP's widespread use increases risk

Approximately 70% of the web uses PHP, according to W3Techs, highlighting the significant attack surface. The vulnerabilities reside in the Zend engine, which compiles and executes PHP code. The first flaw, introduced with PHP 7.3, targets hash table implementation, while the second involves similar mechanisms but requires a poisoning step and a triggering step.

Attack attempts detected before patch release

AWS identified attack attempts as early as October 17, originating from an IP address associated with a commercial anonymization network. Ellio observed attacks before the patch release, including attempts using the leaked PoC and payloads such as a version of the Mirai IoT botnet compiled for 64-bit servers.

Security tools now detect PHP-based attacks

Cloudflare has deployed rules on its WAF to detect attacks on its clients, and OpenAI has published a PHP version checker as a Codex skill. Corelight has made available detection packs for Zeek and Suricata, including rules targeting unique markers in HTTP POST requests and detecting PHP versions through response headers.

Recommendations for mitigating risks

The Luxembourg CERT recommends paying particular attention to websites, APIs, and applications exposed to the Internet, as well as shared hosting environments and CMS platforms. AWS suggests blocking multipart requests at the front-end for applications that do not require file uploads.

Ongoing concerns about patch effectiveness

Several CERTs have highlighted the need to monitor for unusual multipart requests, errors related to memory limits, and anomalous PHPSESSID cookies. Abstract Security has reproduced an RCE using the CVE-2026-109619 flaw on a patched PHP 8.2 host, indicating that the patch does not fully resolve the issue.

Multiple vendors address PHP-related flaws

F5, Citrix, Cisco, Sophos, Synology, and QNAP have all identified vulnerabilities in their products related to PHP and are working on patches or mitigation strategies. Some products, such as Citrix's NetScaler and Cisco's URWB devices, have scheduled fixes for future dates.